CVE-2023-52650

What it actually does

Missing validation of of_find_device_by_node() return value in the Linux kernel DRM Tegra DSI driver allows a NULL pointer to be dereferenced, resulting in a kernel crash.

Why it matters to the business

Systems running affected Linux kernel versions on Tegra hardware can experience unexpected reboots or denial of service when the vulnerable code path is exercised, disrupting workloads that rely on display or DSI functionality.

How an attack unfolds

An attacker with local access on a vulnerable system triggers the Tegra DSI initialization path that calls of_find_device_by_node() without checking for failure; when the function returns NULL the subsequent dereference causes an oops and potential system instability.

How to fix it

Update the Linux kernel to a version containing commit 47a13d0b9d8527518639ab5c39667f69d6203e80 or later; rebuild and deploy the fixed kernel image on all affected Tegra-based systems.

How to confirm the fix worked

Confirm the running kernel contains commit 47a13d0b9d8527518639ab5c39667f69d6203e80 by checking git log or kernel version string; attempt to load the Tegra DSI driver on a system with the original device-tree node removed to verify the error path now returns gracefully instead of dereferencing NULL.

Typical attack path

1. Obtain local user or service account access on a Linux system using the Tegra DSI driver
2. Trigger device-tree node lookup during DSI controller probe or configuration
3. Force of_find_device_by_node() to return NULL via crafted or missing device-tree state
4. Trigger NULL dereference leading to kernel panic or crash

How to detect it

Search kernel logs and crash dumps for oops or panic messages containing references to tegra_dsi and of_find_device_by_node; examine audit or system call logs for unusual local activity immediately preceding crashes on Tegra hardware.

What your security team should do

• Prioritize kernel updates on all Tegra DSI systems within standard change windows
• Review device-tree configurations to ensure required nodes are present
• Monitor kernel logs for NULL pointer dereference oops messages referencing tegra-dsi after deployment